Threshold-Schnorr signatures